> ## Documentation Index
> Fetch the complete documentation index at: https://developer.eka.care/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

Milestone 3 covers two sides of the same flow: an HIU requesting access to a patient's health records, and the patient approving or denying that request. Once consent is approved, EKA handles all the intermediate ABDM gateway callbacks to fetch the data from the HIP.

> [!NOTE]
>
> User authorization is required for all consent operations (approve, deny, revoke).

***

## HIU: Requesting Health Data

An HIU initiates the flow by creating a consent request. The patient receives it on their PHR app and acts on it.

**1. Create a consent request**

Use the [Create Consent](https://developer.eka.care/api-sdk/hie-cm/consents/consent-create.md) API to raise a request for a patient's health records. The request specifies the patient's ABHA address, the purpose, the date range of records needed, and the HIPs to fetch from.

**2. Patient approves the request**

The patient receives the request on their PHR app and approves it. Once approved, EKA handles all the ABDM gateway callbacks required to trigger data fetch from the HIP — no action needed on your side.

**3. Receive the health data**

Once the HIP pushes the data, it is delivered to you in one of two ways depending on how your integration is set up:

**If you manage data on your side:**
You receive the `abha.hiu_data_push` webhook with the encrypted FHIR bundle and `key_information` needed to decrypt it. Set up your HIU public keyset using the [Update Keyset](https://developer.eka.care/api-sdk/hie-cm/care-contexts/hiu-keys.md) API — EKA shares this with the HIP so they can encrypt the data for you.

[abha.hiu\_data\_push webhook →](https://developer.eka.care/docs/hie-cm/webhooks/hiu-data-push.md)

**If EKA stores the data:**
Call the [Retrieve Health Records](https://developer.eka.care/api-sdk/health-records/retrieve-health-records.md) API with the `care_context_id` as the identifier. Get the `care_context_id` from the [Consent Details](https://developer.eka.care/api-sdk/hie-cm/consents/consent-details.md) API after approval.

***

## Patient / PHR App: Managing Consent

From the patient's side, consent requests arrive and can be approved, denied, or revoked at any time.

**1. List consent requests**

Use the [List Consents](https://developer.eka.care/api-sdk/hie-cm/consents/consent-list.md) API to fetch all pending and past consent requests for the patient.

**2. Approve a request**

Use the [Approve Consent](https://developer.eka.care/api-sdk/hie-cm/consents/consent-approve.md) API. You need to provide the consent ID, the care contexts to share, and the HIP details.

On approval, ABDM generates consent artefacts — one per HIP involved. These artefacts authorize the HIU to fetch records from those HIPs.

**3. Deny a request**

Use the [Deny Consent](https://developer.eka.care/api-sdk/hie-cm/consents/consent-deny.md) API with the consent ID and a reason.

**4. Revoke a granted consent**

Use the [Revoke Consent](https://developer.eka.care/api-sdk/hie-cm/consents/consent-revoke.md) API with the consent artefact ID to revoke access for a specific HIP.

***

## Auto-Approval

For recurring or trusted access patterns, you can configure auto-approval policies so patients don't need to manually approve every request.

[Configure Auto-Approval →](https://developer.eka.care/api-sdk/hie-cm/consents/auto-approval/update-auto-approval-policy.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.